The ninth time this year

Cisco published an advisory on Wednesday for CVE-2026-76504, a flaw in the part of Catalyst SD-WAN Manager that handles session logins to its API. The company's description is short. The Manager mishandles URI encoding in an HTTP request, which lets a crafted request slip past an authentication rule meant to fence off one API endpoint. An attacker who sends it needs no account and arrives "as the admin user". There is no workaround. The flaw affects the Manager "regardless of system configuration", and Cisco says its incident response team "became aware of active exploitation of this vulnerability" in September. It was found while Cisco support was working a customer case. The Hacker News reports a CVSS score of 9.8.

The advisory's indicators show how small the trick is. The Manager's login path is j_security_check. In Cisco's example the request is for /%6a_security_check, with %6a standing in for the letter j, and Cisco warns that any single encoded character will do. Administrators are told to search two logs, serviceproxy-access.log and vmanage-server.log, for j_security_check entries from addresses they do not recognise, and in the second for user names beginning viptela-reserved-, the prefix of the Manager's built-in service accounts. The same entries can turn up in normal operation, the advisory adds, so every match has to be checked by hand.

The fixed releases are 20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1 and 26.2.1; anything older than 20.9 has to move to a fixed train. Cisco-managed cloud deployments are already on a fixed build, 20.15.605, and Cisco says its cloud-hosted environments already have the network restriction it recommends for everyone else. For on-premises customers that restriction is the only interim measure: keep the Manager off the internet, or admit only known hosts behind a firewall.

CISA added the CVE to its Known Exploited Vulnerabilities catalogue the same day, with a due date of 3 October. That is a Saturday. The entry carries the forensic-triage flag, which asks federal agencies to look for signs of compromise rather than only patch, and lists ransomware use as "Unknown". Its weakness class is CWE-177, improper handling of URL encoding.

Read across the whole catalogue, this desk counts nine Cisco SD-WAN entries added in 2026. Two arrived on 25 February, an authentication bypass in the Controller and Manager and a path traversal flaw from 2022. Three followed on 20 April, all in the Manager. One in the Controller came on 14 May, two more in the Manager on 9 and 15 June, and now this one. Seven of the nine name the Manager. Three are authentication bypasses in the control plane, the components that tell every branch router what to do.

That is the reason the product keeps returning. An SD-WAN Manager holds configuration and policy for an organisation's whole wide-area network, so admin access to it is close to admin access to every site it manages. Cisco's hardening advice has been the same all year: management interfaces should never face the internet. The Hacker News, comparing advisories, notes that the fixed versions for the May and June flaws are all older than this week's, so a Manager last patched in the summer is still exposed.

What the advisory leaves out is what an operator most wants to know. It does not say how many customers were hit, when exploitation began, who was behind it or what was done with the access, and it gives no word on whether upgrading removes an intruder already inside. Its instruction to run request admin-tech before opening a support case points one way: collect the evidence first, then patch. Federal agencies have until Saturday to do both.